CVE-2025-36436

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

IBM Cloud Pak for Business Automation 25.0.0 through 25.0.0 Interim Fix 002, 24.0.1 through 24.0.1 Interim Fix 005, and 24.0.0 through 24.0.0 Interim Fix 007 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
IBM	Cloud Pak for Business Automation	>= 25.0.0, <= 25.0.0 Interim Fix 002; >= 24.0.1, <= 24.0.1 Interim Fix 005; >= 24.0.0, <= 24.0.0 Interim Fix 007

References

https://www.ibm.com/support/pages/node/7259318Vendor Advisory

Timeline

Published: Feb 2, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-364374.3IBM Planning Analytics Local 2.1.0 - 2.1.15 could disclose sensitive information about server architecture that could aid in further attacks CVE-2025-364385.5IBM Concert 1.0.0 through 2.2.0 could allow a privileged user to perform unauthorized actions due to improper restriction of channel communi CVE-2025-36444.3A flaw was found in Moodle. Additional checks were required to prevent users from deleting course sections they did not have permission to m CVE-2025-364405.5IBM Concert 1.0.0 through 2.2.0 could allow a local user to obtain sensitive information due to missing function level access control.CVE-2025-364427.5IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 is vulnerable to a denial of service a CVE-2025-36454.3A flaw was found in Moodle. Insufficient capability checks in a messaging web service allowed users to view other users' names and online st CVE-2025-36468.2Petlibro Smart Pet Feeder Platform versions up to 1.7.31 contains an authorization bypass vulnerability that allows unauthorized users to ad CVE-2025-364607.3Multiple out-of-bounds read and write vulnerabilities exist in the ControlVault WBDI Driver Broadcom Storage Adapter functionality of Dell C CVE-2025-364617.3Multiple out-of-bounds read and write vulnerabilities exist in the ControlVault WBDI Driver Broadcom Storage Adapter functionality of Dell C CVE-2025-364627.3Multiple out-of-bounds read and write vulnerabilities exist in the ControlVault WBDI Driver Broadcom Storage Adapter functionality of Dell C CVE-2025-364637.3Multiple out-of-bounds read and write vulnerabilities exist in the ControlVault WBDI Driver Broadcom Storage Adapter functionality of Dell C CVE-2025-36474.3A flaw was discovered in Moodle. Additional checks were required to ensure that users can only access cohort data they are authorized to ret